ReadyEcommerce EUVD-2026-55628

Exploitation requires a valid customer account on the ReadyEcommerce platform - no elevated role is needed, but unauthenticated exploitation is not possible (CVSS PR:L). The attacker must submit a malicious payload through the customer-facing chat system or support ticket submission form, both of which are standard platform features active in default deployments. Exploitation further requires passive interaction from a shop owner or administrator (CVSS UI:P): the malicious message must be viewed in one of the four vulnerable components. Limiting factors are the PR:L customer account requirement and the UI:P dependency on an admin viewing the content, introducing a timing gap. There is no indication that non-default configuration is required - the affected features appear to be core platform components enabled by default.

The CVSS 4.0 score of 5.1 with vector AV:N/AC:L/AT:N/PR:L/UI:P accurately reflects the attack profile: low-complexity network attack, low-privilege authentication (customer account), and passive user interaction (admin viewing a message). The subsequent-system metrics (SC:L/SI:L) capture the cross-context privilege escalation to administrator scope. No EPSS data was provided, limiting probabilistic exploitation estimation. There is no CISA KEV listing and no known public exploit code, indicating this has not seen widespread active exploitation. Despite the moderate score, the real-world risk is meaningful: any registered customer can target shop owners, and the impact (admin account takeover) is high even though the CVSS impact metrics are rated Low. The PR:L and UI:P requirements are the primary limiting factors depressing the score, and defenders should weigh the asymmetric impact - a low-barrier attack with a high-value target.

A registered customer submits a support ticket containing a crafted payload such as an img tag with an onerror handler that exfiltrates document.cookie to an attacker-controlled server. When a shop owner or administrator opens the support ticket or chat thread in their browser, the payload silently executes, transmitting the admin's session cookie. The attacker replays the stolen cookie to authenticate as the administrator and takes full control of the merchant account.